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Secrecy capacity of a multiple-antenna wiretap channel is studied in the low signal-to-noise ratio (SNR) regime. 
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Expressions for the first and second derivatives of the secrecy capacity with respect to SNR at SNR = are derived. 
Transmission strategies required to achieve these derivatives are identified. In particular, it is shown that it is optimal 
in the low-SNR regime to transmit in the maximal-eigenvalue eigenspace of 3? = Hj n H m — -^p-HjH e where H m 
and H e denote the channel matrices associated with the legitimate receiver and eavesdropper, respectively, and N m 
and N e are the noise variances at the receiver and eavesdropper, respectively. Energy efficiency is analyzed by 
finding the minimum bit energy required for secure and reliable communications, and the wideband slope. Increased 
bit energy requirements under secrecy constraints are quantified. Finally, the impact of fading is investigated, and 
the benefits of fading in terms of energy efficiency are shown. 
£> ' Index Terms: Energy efficiency, energy per secret bit, fading channels, Gaussian channels, information-theoretic 
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£vq , security, low-SNR regime, MIMO systems, secrecy capacity. 

^ . I. Introduction 

Secure transmission of confidential messages is a critical issue in communication systems and especially 



X 



in wireless systems due to the broadcast nature of wireless transmissions. In [1], Wyner addressed the 



■ transmission security from an information-theoretic point of view, and identified the rate-equivocation 
region and established the secrecy capacity of the discrete memoryless wiretap channel in which the 
wiretapper receives a degraded version of the signal observed by the legitimate receiver. The secrecy 
capacity is defined as the maximum communication rate from the transmitter to the legitimate receiver, 
which can be achieved while keeping the eavesdropper completely ignorant of the transmitted messages. 
Later, these results are extended to Gaussian wiretap channel in [2]. In [3], Csiszar and Korner considered 
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a more general wiretap channel model and established the secrecy capacity when the transmitter has a 
common message for two receivers and a confidential message to only one. Recently, there has been a 
flurry of activity in the area of information-theoretic security, where, for instance, the impact of fading, 
cooperation, and interference on secrecy are studied (see e.g., [4] and the articles and references therein). 
Several recent results also addressed the secrecy capacity when multiple- antennas are employed by the 
transmitter, receiver, and the eavedropper [5]-[9]. The secrecy capacity for the most general case in which 
arbitrary number of antennas are present at each terminal has been established in [8] and [9]. 

In addition to security issues, another pivotal concern in most wireless systems is energy-efficient oper- 
ation especially when wireless units are powered by batteries. From an information-theoretic perspective, 
energy efficiency can be measured by the energy required to send one information bit reliably. It is well- 
known that for unfaded and fading Gaussian channels subject to average input power constraints, energy 
efficiency improves as one operates at lower snr levels, and the minimum bit energy is achieved as 
snr vanishes [11]. Hence, requirements on energy efficiency necessitate operation in the Iow-snr regime. 
Additionally, operating at low snr levels has its benefits in terms of limiting the interference in wireless 
systems. 

In this paper, in order to address the two critical issues of security and energy-efficiency jointly, we study 
the secrecy capacity in the Iow-snr regime. It is worthwhile to note that operation at low snrs, in addition 
to improving the energy efficiency, is beneficial from a security perspective as well. In the Iow-snr regime, 
either the transmission power is small or the bandwidth is large. In either case, we have low probability 
of intercept as it is generally difficult for an eavesdropper to detect the signals in this regime. 

We consider a general multiple-input and multiple-output (MIMO) channel model and identify the 
optimal transmission strategies in the Iow-snr regime under secrecy constraints. Since secrecy capacity 
is in general smaller than the capacity attained in the absence of confidentiality concerns, energy per bit 
requirements increase due to secrecy constraints. In this work, we quantify these increased energy costs 
and address the tradeoff between secrecy and energy efficiency. The main contributions of the paper are 
listed below: 

1) We determine the first and second derivatives of the secrecy capacity at snr = 0, and provide a 
second-order approximation to the MIMO secrecy capacity in the Iow-snr regime. Through this 



2 



analysis, we quantify the impact of secrecy constraints on the performance. 

2) We identify the optimal transmission strategies in the Iow-snr regime. In particular, we determine 
that transmission in the maximal-eigenvalue eigenspace of a certain matrix that depends on the 
channel matrices is second-order optimal. In the case in which the maximum eigenvalue is distinct, 
beamforming is shown to be optimal. 

3) We find the minimum energy required to send one bit both reliably and securely. We characterize 
the tradeoff between energy efficiency and secrecy. 

4) We investigate the impact of fading by studying the Iow-snr secrecy capacity in fading scenarios. 
We show that in general both independent and correlated fading improves the energy efficiency. 

The remainder of the paper is organized as follows. In Section HU we describe the channel model. In 
Section Hm we study the secrecy capacity in the Iow-snr regime and determine the minimum energy per 
secret bit. We investigate the impact of fading in Section [IV] and provide conclusions in Section [V] Lengthy 
proofs are relegated to the Appendix. 

II. Channel Model 

We consider a MEMO channel model and assume that the transmitter, legitimate receiver, and eaves- 
dropper are equipped with n,T,nR, and % antennas, respectively. We further assume that the channel 
input-output relations between the transmitter and legitimate receiver, and the transmitter and eavesdropper 
are given by 

y m = H m x + n m and y e = H e x + n e , (1) 

respectively. Above, x denotes the x 1-dimensional transmitted signal vector. This channel input is 
subject to the following average power constraint: 

E{||x|| 2 } = tr(K !B )<P (2) 

where tr denotes the trace operation and K x = E{xx^} is the covariance matrix of the input. In ©, 
ur x 1-dimensional y m and %x 1-dimensional y e represent the received signal vectors at the legitimate 
receiver and eavesdropper, respectively. Moreover, n m with dimension rijjxl and n e with dimension n E xl 
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are independent, zero-mean Gaussian random vectors with ^{rimn^} = N m I and E{n e iil} = N e l, where 
I is the identity matrix. The signal-to-noise ratio is defined as 

E{||x|| 2 } P 

SNR = — ^ "„- = — . (3) 

E{||n m || 2 } n R N m 

Finally, in the channel models, H m is the tir x ny-dimensional channel matrix between the transmitter 
and legitimate receiver, and H e is the tie x riT-dimensional channel matrix between the transmitter and 
eavesdropper. While being fixed deterministic matrices in unfaded channels, H m and H e in fading channels 
are random matrices whose components denote the fading coefficients between the corresponding antennas 
at the transmitting and receiving ends. 

III. Secrecy in the Low-SNR Regime 

Recently, in [8] and [9], it has been shown that when the channel matrices H m and H e are fixed for 
the entire transmission period and are known to all three terminals^, then the secrecy capacity in nats per 
dimension is given byP 

C s = — max logdet { I H HmKjHl ) — logdet ( I H HeK^HH nats/s/Hz/dimension (4) 

n R \ N m J \ N e J 

tr(K x )<P 

where the maximization is over all possible input covariance matrices K x . y (J^| subject to a trace constraint. 
We note that since logdet (i + l/iV m H m K a ;H] n ) is a concave function of K x , the objective function in 
© is in general neither concave nor convex in K^, making the identification the optimal input covariance 
matrix a difficult task for arbitrary snr levels. 

In this paper, we concentrate on the Iow-snr regime. In this regime, the behavior of the secrecy capacity 
can be accurately predicted by its first and second derivatives with respect to snr at snr = 0: 

C S (SNR) = C Y s (0)SNR + — ^— ^-SNR 2 + o(SNR 2 ). (5) 



'The assumption of perfect channel knowledge can, for instance, be justified in scenarios in which a base station, which knows the channels 
of the users, attempt to transmit confidential messages to a user and hence treat the other users as eavesdroppers. 

2 Unless stated otherwise, all logarithms throughout the paper are to the base e. 

3 ^ and >- denote positive semidefinite and positive definite partial orderings, respectively, for Hermitian matrices. If A X B, then A — B 
is a positive semidefinite matrix. Similarly, A y B implies that A B is positive definite. 
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Moreover, O s (0) and C s (0) also enable us to analyze the energy efficiency in the Iow-snr regime through 
the following notions [11]: 

1 2 

(6) 



E b log2 2 

and oq 



0(0) 



^Vmin C s (0) -0,(0) 

where denotes the minimum bit energy required for reliable communication under secrecy con- 

straints (or equivalently minimum energy per secret bit), and So denotes the wideband slope which is the 
slope of the secrecy capacity in bits/dimension/(3 dB) at the point . . These quantities provide a linear 
approximation of the secrecy capacity in the Iow-snr regime. While is a performance measure for 

vanishing snr, <S together with |£ characterize the performance at low but nonzero snrs. We note 
that the formula for the minimum bit energy is valid if C s is a concave function of snr, which we show 
later in the paper. 

A. First and Second Derivatives of the Secrecy Capacity 

Through the following result, we identify the first and second derivatives of the secrecy capacity at 
snr = 0. 

Theorem 1: The first derivative of the secrecy capacity in © with respect to snr at snr = is 

A max ($) if A max ($) > 
C s (0) = [A max ($)]+ = { (7) 

else 

where <fr = Hj^H,™ — ^H^H e . C s (0) can be achieved by choosing the input covariance matrix as 
K x = P uu^ where P denotes the average power and u is the normalized eigenvector that corresponds to 

A max ($). 

Moreover, the second derivative of the secrecy capacity at snr = is given by 

1 / ]\T2 \ 

0,(0) = -n R mm ^ onaj I | ujH|„H m u, | 2 - -^|u]HjH eUi | 2 J l{A max ($ > 0)} (8) 

where / is the multiplicity of A max ($) > 0, {uj} are the eigenvectors that span the maximal-eigenvalue 

1 if A max (<I>) > 

eigenspace of <&, and l{A max (<I>) > 0} = ^ is the indicator function. The second 

else 



derivative is achieved by choosing K. x = PJ2i=i a i u i u l where the values of {cti} are determined by the 
optimization problem in ©. 
Proof: See Appendix |A"1 

Remark 1: In the absence of secrecy constraints, the first and second derivatives of the MIMO capacity 
at snr = are [11] 

(7(0) = A max (H] n H m ) and (7(0) = -^A^JH^HJ (9) 

where I is the multiplicity of A max (Hj n H m ). Hence, the first and second derivatives are achieved by 
transmitting in the maximal-eigenvalue eigenspace of Hj„H m , the subspace in which the transmitter- 
receiver channel is the strongest. Due to the optimality of the water-filling power allocation method, power 
should be equally distributed in each orthogonal direction in this subspace in order for the second derivative 
to be achieved. 

Remark 2: We see from Theorem \T\ that when there are secrecy constraints, we should at low snrs 
transmit in the direction in which the transmitter-receiver channel is strongest with respect to the transmitter- 
eavesdropper channel normalized by the ratio of the noise variances. For instance, C s (0) can be achieved by 
beamforming in the direction in which the eigenvalue of <fr is maximized. On the other hand, if A max (<I>) has 
a multiplicity, the optimization problem in ([8]) should be solved to identify how power should be allocated 
to different orthogonal directions in the maximal-eigenvalue eigenspace so that the second-derivative (7 S (0) 
is attained. In general, the optimal power allocation strategy is neither water- filling nor beamforming. For 
instance, consider parallel Gaussian channels for both transmitter-receiver and transmitter-eavesdropper 
links, and assume that H^H™ = diag(5,4, 2) and H^H e = diag(2, 1, 1) where diag() is used to denote 
a diagonal matrix with components provided in between the parentheses. Assume further that the noise 
variances are equal, i.e., N m = N e . Then, it can be easily seen that A max ($) = 3 and has a multiplicity 
of 2. Solving the optimization problem in © provides a>i = 5/12 and a 2 = 7/12. Hence, approximately, 
42% of the power is allocated to the channel for which the transmitter-receiver link has a strength of 5, 
and 58% is allocated for the channel with strength 4. 

Remark 3: When A max (<I>) > is distinct, then beamforming in the direction in which A(«J>) is maxi- 
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mized is optimal in the sense of achieving both C s (0) and C s (0). Moreover, in this case, we have 

C s (0) = -n R (j|H mUl || 4 - ^||H eUl || 4 ^ (10) 

where u x is the eigenvector that corresponds to A max (<3>). 

Remark 4: From [15, Theorem 4.3.1], we know that for two Hermitian matrices A and B with the same 
dimensions, we have 



A m ax(A + B) < A max (A) + A max (B). 



(11) 



Applying this result to our setting yields 



Amax(^) < A max (Hj ri H m ) — A min ^-^pH^H e ^ . 



(12) 



Therefore, we conclude from Remark \T\ that when A max (<fr) > 0, secrecy constraints diminish the first 
derivative C s (0) at least by a factor of A min ^^pHjH e j when compared to the case in which there are no 
such constraints. 

Remark 5: In the case in which the transmitter has a single antenna (i.e, nx = 1), the channel matrices 
become column vectors. Denoting these column vectors as h m and h e , we can immediately see from the 
result of Theorem Q] that 



0,(0) 



|h II 2 - — llh II 2 

I'M ^ H n eH 



and C s (0) = -n R 



N 2 

|h i|4 _ —mwh || 4 

I "mil N 2" 1Le " 



(13) 



Similarly, if each terminal has a single antenna (i.e., nx = = n E = 1), the results of Theorem Q] 
specialize to 



Cs(0) 



\ hm \2_^ h \2 

N P 1 



N 2 

\h I 4 _ —HL\h I 4 



(14) 



and C s (0) = 

Heretofore, we have considered the secrecy capacity which is obtained by finding the optimal input 
covariance matrix that maximizes the secrecy rate 



J s (snr) 



1 

n R 



loerdet ( I 



1 



TT TV" TTT 

' "-m "-x "-m 



logdetll + ^H^Ht 



(15) 
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Hence, for a given input covariance matrix K x , the expression in (fl~5l) provides the rate of secure communi- 
cation. Using the same techniques as in the proof of Theorem \T\ we can immediately obtain the following 
characterization. 

Corollary 1: For a given input covariance matrix K x , the first derivative of the secrecy rate in (fl~5l) with 
respect to snr at snr = is 



tr ( H^H^ - ^H e K,Ht 



tr ( ( - ^Ht He ) K x 



tr $K, 



(16) 
(17) 



where = -^K^ is the normalized input covariance matrix, and <fr is again defined as $ = Hj^H™ — 
^pH^H e . The second derivative of the secrecy rate at snr = is given by 



(18) 



(H^HL) - jfi (HeK.Hl) J 1 {tr ($K X ) > o} . 
Proof: See Appendix El 

For instance, if the transmitter opts to uniformly allocate the power across the antennas, the covariance 
matrix becomes K x = ^-1. Hence, we have K x = In this case, we can readily see from Corollary Q] 



that we have 





+ 


— tr (#) 









< [A max ($)] + . 



(19) 



This result indicates that when we have uniform power allocation, the first derivative of the secrecy rate 
is proportional to the average of the eigenvalues of <fr rather than the maximum eigenvalue, and we in 
general experience, as expected, a loss in performance. 

We now illustrate the theoretical results through numerical analysis. We consider a system in which all 
terminals have 3 antennas, i.e., ut = ur = he = 3. Assume that the channel matrices are 



1 0.8 0.5 
0.3 1 0.1 
0.1 0.2 0.1 



and H, 



0.5 0.4 1 
0.7 0.1 0.5 
0.3 0.5 0.1 



(20) 
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Fig. 1. Secrecy rates in nats/s/Hz/dimension vs. SNR. 



Assume further that N m — N e — 1. It can be easily verified that the maximum eigenvalue of the matrix 
$ = H^Hm — HjH e is distinct and is equal to A max (<I?) = 1.6298. The eigenvector that corresponds to 
Amax(^) is uT = [—0.4677 —0.8823 0.054]. Therefore, the covariance matrix that is optimal in the sense 
of achieving both the first and second derivatives of the secrecy capacity is K a . = Puul In Figure [T]in 
which secrecy rates are plotted as a function of snr, the dashed curve shows the secrecy rates achieved 
when this input covariance matrix is employed. Note that this secrecy rate curve is optimally close to 
the secrecy capacity in the Iow-snr regime as it has the same first and second derivatives. Note also that 
for the considered model, we have C* s (0) = A max (<3?) = 1.6298. Fig. 1 also provides secrecy rates for 
two suboptimal choices of K^. The dot-dashed curve plots the secrecy rates when K x = Pvvt where 
v is the eigenvector that corresponds to A max (Hj ri H m ). Hence, transmission in this case is performed in 
the direction in which the channel between the transmitter and legitimate receiver is strongest. Note that 
this strategy is optimal in the Iow-snr regime if there are no secrecy considerations. However, as we also 
observe in the figure, it is in general suboptimal in the wiretap channel model. Even the slope at zero 
snr is smaller. Indeed, the slope is J s (0) = tr($K x .) = 1.2444. In Fig. Q3 we also plot the secrecy rates 
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(with the dotted curve) when the power is uniformly allocated across the antennas. In this case, we have 
J s (0) = |tr($) = 0.18, which is about 11% of C s (0). Inefficiency of uniform power allocation is further 
evidenced in the observation that the secrecy rates start diminishing as snr is increased beyond 0.94, due 
to the fact that transmission is also possibly being conducted in the directions in which the eavesdropper's 
channel is strong and consequently, increasing the power improves the eavesdropper's ability to wiretap 
the channel. Finally, as a comparison, we plot in Fig. Q] the rates achieved in the absence of secrecy 
constraints when K x = P vv+ with v as defined above. For this case, the first derivative of the capacity is 
A max (Ht i H) = 2.7676. 

B. Minimum Energy per Secret Bit 

In this section, we study the energy required to send information both reliably and securely. In particular, 
we investigate the minimum energy required to send one secret bit. Before identifying the minimum energy 
per secret bit, we first show that the secrecy capacity is concave in snr. 

Proposition 1: The secrecy capacity C s achieved under the average power constraint E{||x|| 2 } < P is 
a concave function of snr. 

Proof: Concavity can be easily shown using the time-sharing argument. Assume that at power level Pi 
and signal-to-noise ratio SNRi, the optimal input is x ls which satisfies E{||xi|| 2 } < Pi, and the secrecy 
capacity is C s (sNRi). Similarly, for P 2 and snr 2 , the optimal input is x 2 , which satisfies E{||x 2 || 2 } < P 2 , 
and the secrecy capacity is C s (snr 2 ). Now, we assume that the transmitter performs time-sharing by 
transmitting at two different power levels using xi and x 2 . More specifically, in 6 fraction of the time, 
the transmitter uses the input x x , transmits at most at P l5 and achieves the secrecy rate C s (snRi). In the 
remaining (1 — 6) fraction of the time, the transmitter employs x 2 , transmits at most at P 2 , and achieves 
the secrecy rate C s (snr 2 ). Hence, this scheme overall achieves the average secrecy rate of 

^C S (SNR 1 ) + (1-^)C S (SNR 2 ) (21) 

by transmitting at the level #E{||xi|| 2 } + (1 - #)E{||x 2 || 2 } < P B = QP X + (1 - 0)P 2 . The average signal- 
to-noise ratio is snr# = #SNRi + (1 — 6>)snr 2 . Therefore, the secrecy rate in (l2"D) is an achievable secrecy 
rate at snr$. Since the secrecy capacity is the maximum achievable secrecy rate, the secrecy capacity at 
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SNRg is larger than that in ([2TT) . i.e., 



C s (SNR e ) = C s (0SNRi + (1 - #)SNR 2 ) > 0C s (SNRi) + (1 - #)C S (SNR 2 ), (22) 

showing the concavity. ■ 
We further note that the concavity can also be shown using the following facts. As also discussed in 
[10], MIMO secrecy capacity is obtained by proving in the converse argument that the considered upper 
bound is tight and 

C s = max min I(x;y r |yg) (23) 

where V is the set of joint conditional density functions p(y r , y e |x) that satisfy p(y r |x) = p(y r |x) and 
p(y e |x) = p(y e |x). Note that for fixed channel distributions, the mutual information J(x;y^.|y e ) is a 
concave function of the input distribution p(x). Since the pointwise infimum of a set of concave functions 
is concave [16], /(p(x)) = min p ( y ' iy 'i x ) e:D /(x;y r |y' e ) is also a concave function of p(x). Concavity of the 
functional / and the fact that maximization is over input distributions satisfying E{||x|| 2 } < P lead to the 
concavity of the secrecy capacity with respect to SNR. 

The energy per secret bit normalized by the noise variance at the legitimate receiver is defined as 

f = ™l 0g2 . (24) 

As mentioned before, since the secrecy capacity is a concave function of snr, the minimum energy per 
secret bit is achieved as snr — > and hence is given by 

^ = lim 4^1og2 = i^. (25) 

iVmin SNR^0C s (SNR) C s (0) 

We can now write the following corollary to Proposition [T] and Theorem \T\ 

Corollary 2: The minimum bit energy attained under secrecy constraints (i.e., minimum energy per 
secret bit) is 

E b log 2 



^Os.min [Amax ($)]+' 



(26) 
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Remark 6: From Remark H we can write for A max (<fr) > 

E* = log 2 > log_2 > log 2 = 

N 0sM n A max ($) " Amax(H LH m ) - A min (^H^H e ) " A max (H m H m ) N Qmin 

where ^ . in (1271) denotes the minimum bit energy in the absence of secrecy constraints. Hence, in 
general, secrecy requirements increase the energy expenditure. When secure communication is not possible, 

[A max ($)] + = and § . =oc. 

1 "0 s,min 

Remark 7: Energy costs of secrecy can easily be identified in the case in which the transmitter has a 
single-antenna. Clearly, the minimum bit energy in the presence of secrecy is strictly greater than that in 
the absence of such constraints: 

E b log 2 log 2 E b 



N, 



s,min 



It, 112 _ Nm lit, 112 
l lim H N e H lie ll 



|h m || 2 N 0l 



when ^p||h e || 2 > 0. Furthermore, the energy requirement increases monotonically as the value of ^p-||h e || 2 
increases. Indeed, when ^H|h P || 2 = ||h m || 2 , secure communication is not possible and |k = oo. 

N e II en || mil » f Af 0s ,min 

The expression for the wideband slope So can be readily obtained by plugging in the expressions in © 
and © into that in ©: 



c a (o) 2 



2([A max ($)]+) 2 



^ (0) n R mm K} £j j=i <*i<*3 ( |utHj„H m m| 2 - ^iitH^u^ l{A max ($ > 0)} 

oie[o,i]Vj 'V / 

In Fig. |2l we plot the secrecy rates in bits/s/Hz/dimension as a function of the energy per secret bit 



under the same assumptions and channel model as in Fig. [TJ We see, as predicted, that the minimum 
bit energy is attained in all cases as snr and hence rates approach zero. While the minimum bit energy 
is . = = —6.01 dB in the absence of secrecy constraints, the minimum bit energy per 

*»0 min Amax(H m H m ) 

secret bit is = . log , 2 , ^ = —3.71 dB. Therefore, secrecy constraints lead to an increase of 2.3 dB 

in the minimum energy requirements. We also note that the energy cost of secrecy increases as secrecy 
rates increase. Moreover, we observe that the suboptimal choices of K a . induce additional energy penalties. 
When we have K x = Pvv^ where v is the eigenvector that corresponds to A max (H] n H m ), the minimum 
bit energy is —2.54 dB. In the case of uniform power allocation, the minimum bit energy requirement 
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Fig. 2. Secrecy rates in bits/s/Hz/dimension vs. energy per secret bit 



n . 



jumps to 5.85 dB. 



IV. The Impact of Fading 



In this section, we assume that the channel matrices H m and H e are random matrices whose components 
are ergodic random variables, modeling fading in wireless transmissions. We again assume that realizations 
of these matrices are perfectly known by all the terminals. As discussed in [12], fading channel can be 
regarded as a set of parallel subchannels each of which corresponds to a particular fading realization. 
Hence, in each subchannel, the channel matrices are fixed similarly as in the channel model considered in 
the previous section. In [12], Liang et al. have shown that having independent inputs for each subchannel is 
optimal and the secrecy capacity of the set of parallel subchannels is equal to the sum of the capacities of 
subchannels. Therefore, the secrecy capacity of fading channels can be be found by averaging the secrecy 
capacities attained for different fading realizations. 

We assume that the transmitter is subject to a short-term power constraint. Hence, for each channel 
realization, the same amount of power is used and we have tr (K x ) < P. With this assumption, the 
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transmitter is allowed to perform power adaptation in space across the antennas, but not across time. 
Under such constraints, it can easily be seen from the above discussion that the average secrecy capacity 
in fading channels is given by 

C s =— E Hm , He | max log det (l + -^H^H^ - log det (l + -^-H e K x H^ 1 

where the expectation is with respect to the joint distribution of (H m , H e ). Note that the only difference 
between © and (1291) is the presence of expectation in (|29l) . Due to this similarity, the following result can 
be obtained immediately as a corollary to Theorem [IJ 

Corollary 3: The first derivative of the average secrecy capacity in (1291) with respect to snr at snr = 

is 

C Y s(0)=E Hm ,H e {[A max ($)] + } (29) 

where again $ = H^H™, — ^H^H e . The second derivative of the average secrecy capacity at snr = 
is given by 

C , s (0) = -n /? E Hm ,H e | miri ^ a^- (VjH^H mUi | 2 - ^\u]utU e uAl{X max (^) > 0}\ (30) 

where 1{-} again denotes the indicator function, / is the multiplicity of A max ($) > 0, and {u,} are the 
eigenvectors that span the maximal-eigenvalue eigenspace for particular realizations of H m and H e . 

Remark 8: Similarly as in the unfaded case, C* s (0) is achieved by always transmitting in the maximal- 
eigenvalue eigenspace of the realizations of the matrix <fr. In order to achieve the second derivative, optimal 
values of {ttj} (or equivalently the optimal power allocation across the antennas) should be identified again 
for each possible realization of <I>. 

Remark 9: In the case in which Ut = 1, the first and second derivatives of the average secrecy capacity 
become 



Cs(0) = E hmihe 



I mil N II e|| 



+ 



and (7,(0) = -n R E hmthe 



N 2 

—ULWYi II 4 

N3 11 e " 



Similarly as in Section [Tll-Bl we can identify the minimum energy per secret bit as follows. 
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Corollary 4: The minimum energy per secret bit required in fading channels is 



N 0t 



log 2 



(3D 



E HmiHe {[A max ($)]+}- 

Remark 10: Fading has a potential to improve the Iow-snr performance and hence the energy efficiency. 
To illustrate this, we consider the following example. Assume nr — ur — tie — 1. Consider first the 
unfaded Gaussian channel in which the deterministic channel coefficients are h m — h e — 1. For this case, 



we have 



0,(0) 



N 



and 



N 0l 



log 2 



1 _ Mm. 



+ ' 



(32) 



Now, consider a Rayleigh fading environment and assume that h m and h e are independent, zero-mean, 
circularly symmetric Gaussian random variables with variances E{\h m \ 2 } = E{\h e \ 2 } = 1. Then, we can 
easily find that 



C s {0) = E 



I | | he \ 



N m + N e 



(33) 



leading to = Note that if N e > 0, 

° NO e rviiv, tl& 



N m + N e 



N m +N e 



> 



1 _ iY«L 



. Hence, fading strictly improves the 



Iow-snr performance by increasing C s (0) and decreasing the minimum bit energy even without performing 
power control over time. Further gains are possible with power adaptation. Another interesting observation 
is the following. In unfaded channels, if N m > N e , the minimum bit energy is infinite and secure 
communication is not possible. On the other hand, in fading channels, the bit energy is finite as long as N m 
is finite and N e > 0. Clearly, even if N m > N e , favorable fading conditions enable secure transmission in 
fading channels. The positive impact of fading on secrecy rates especially at low snrs has been discussed 
for instance in [13] and [14]. Here, we provide a similar observation from the energy efficiency perspective. 

Above, we have assumed that the fading coefficients h m and h e are independent. Next, we demonstrate 
that the gains are still observed even if the channel coefficients are correlated. We again assume that h m 
and h e axe zero-mean, circularly symmetric Gaussian random variables with E{|/i m | 2 } = E{|/i e | 2 } = 1. 
Let us denote r m = \h m \,z m = \h m \ 2 and r e = \h e \,z e = \h e \ 2 . Using the following bivariate Rayleigh 
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correlation coefficient p 



vs. correlation coefficient p. 



0.8 



probability density function given in [17, Equation 6.2] 



771' e 

1^7 



we can easily obtain the bivariate exponential density as 



P 



" ' l-p 



1-P 



(34) 



(35) 



In the above formulation, J denotes the zeroth order modified Bessel function of the first kind. Moreover, 
p denotes the power correlation coefficient, which is related to the correlation coefficients of the underlying 
Gaussian random variables h m and h e , and is given by [17] 

\^{hmK}\ 2 



P 



(36) 



E{|/i m | 2 }£{|/i e | 2 } 

under the assumption that h m and h e are zero-mean. With this characterization, we can now easily compute 



4(0) = E hmAe 



I h, 



12 Nrr. 

Ne 



\h. 



, from which we can obtain the minimum energy per secret bit 
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Fig. 4. Secrecy capacity in bits/s/Hz/dimension vs. energy per secret bit -rr- when tit = 1,tiji = 5, and ng = 3 



El 

No s,min 



^T^r. In Fig. [31 the minimum energy per secret bit is plotted as a function of the correlation 



g,(o) 



coefficient p. When p = and hence the channel coefficients are independent, we have || 



log 2 



iVm+JVe 



= 1.419 dB. As the correlation increases, the minimum bit energy value increases. However, note that 



the bit energy values are finite unless there is full correlation. Note further that if there were no fading, 

lo J 2 1+ = oo (recalling the assumption that N m = N e = 1). Hence, in general, 



we would have % L 

N s,min 



correlated fading provides improvements in secure communication as well. 

Above, improvements in the minimum energy per secret bit, which is attained as snr vanishes, are 
discussed. In general, fading is beneficial in terms of energy efficiency at nonzero snr levels as well. This 
is demonstrated in Fig. HI In this figure, we plot the secrecy capacity when ut — 1,Ur — 5, and ue = 3. 
We consider two scenarios: no fading and i.i.d. Rayleigh fading. In the case in which there is no fading, we 
assume that the channel coefficients are all equal to 1. In the fading scenario, we assume that the channel 
vectors h m and h e consist of independent and identically distributed, zero-mean Gaussian components each 
with unit variance, i.e., E{|/i m j| 2 } = 1 and E{|/i e) j| 2 } = 1 for all i. We additionally assume that h m and 
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h e are independent of each other. Note that under these assumptions, ||h m || 2 and ||h e || 2 are independent 
chi-square random variables with 2n R and 2n E degrees of freedom, respectively. In Fig.Hl we observe that 
better performance is achieved in the presence of fading. As readily seen, the minimum energy per secret 
bit required in Rayleigh fading is smaller. Moreover, for a given secrecy capacity value, less bit energy is 
needed in the presence of fading. Indeed, energy gains tend to increase at higher values of secrecy capacity. 
For instance, when C s = 0.14 bits/s/Hz/dimension, we have a gain of approximately 8 dB in . Note 
that this is a substantial improvement in energy efficiency. 

As another benefit, fading enables secure communication, which otherwise is not possible in a non- 
fading environment. For instance, under the assumptions that tit — 1 and all channel coefficients are equal 
to 1, secrecy capacity is zero if the legitimate receiver has the same as or less number of antennas than the 
eavesdropper. However, this is not necessarily the case in fading scenarios. Due to the randomness of fading 
coefficients, there are instants with non-zero probabilities, in which the main channel is stronger than the 
eavesdropper's channel even though hr < ue- This is illustrated in Fig. [5] in which we plot the secrecy 
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capacity as a function of jjfc in i.i.d. Rayleigh fading for different values of tir when we have riy = 1 
and 7i£ = 3. Note that even when < 3, we require finite bit energy for secure communications. In the 
above-mentioned non-fading scenario, we would have = oo. Additionally, we note that performance, 
as expected, improves and less energy per secret bit is required as the number of receive antennas n R 
increases. 

V. Conclusion 

In this paper, we have analyzed the MIMO secrecy capacity in the Iow-snr regime. We have obtained 
expressions for the first and second derivatives of the secrecy capacity at snr = 0. Using these expressions, 
we have identified the optimal transmission strategies in the low-SNR regime under secrecy constraints. In 
particular, we have shown that it is optimal to transmit in the maximal-eigenvalue eigenspace of the matrix 
<3? = Hj^Hm — ^pH^Hg. We have compared the Iow-snr results with those obtained in the absence of 
secrecy constraints, and quantified the degradation in the performance. We have determined the minimum 
bit energy required for secure and reliable communications in the presence of an eavesdropper. We have 
shown that secrecy in general increases the bit energy requirements. We have also noted that the suboptimal 
choices of transmission strategies can incur additional energy penalties. Numerical results are provided to 
illustrate the theoretical findings. Following the analysis for the fixed channel, we have investigated the 
Iow-snr secrecy capacity in the presence of fading. We have generalized our derivative results to apply 
to the perfectly-known fading channel. We have demonstrated the benefits of fading in terms of energy 
efficiency. 

Appendix 

A. Proof of Theorem [7] 

We first note that the input co variance matrix = E{xx^} is by definition a positive semidefinite 
Hermitian matrix. As a Hermitian matrix, K x . can be written as [15, Theorem 4.1.5] 

K x = UAU* (37) 
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where U is a unitary matrix and A is a real diagonal matrix. Using (|37l) . we can also express K x as 

"T 

^ = £^11} (38) 

i=i 

where {di} are the diagonal components of A, and {uj} are the column vectors of U and form an 
orthonormal set. Assuming that the input uses all the available power, we have tr(K x ) = J2i=idi = P- 
Noting that K. x is positive semidefinite and hence di > 0, we can write di = otiP where cti G [0, 1] Vz and 
a i — 1- Now, the secrecy rate achieved with a particular covariance matrix K. x can be expressed as 

iff nT \ ( n N nT N 

— ( log det ( I + n R snr «iH m Uiu|H^ j - log det ( I + ^ m snr aiH 6 UiiijHt 



J s (snr) = 

where snr is defined in ©. As also noted in [11], we can easily show that 

^ log det (I + vA 



dv 
dv 



= tr(A), (39) 

v=0 



log det (I + vA) 



-tr(A 2 ). (40) 



v=0 



Now, using (1391) . we obtain the following expression for the first derivative of the secrecy rate I s with 
respect to snr at snr = 0: 

I s (0) = J2 a * (tr(H mUi ulHtJ - -ptr(H eUi utHt) j (41) 
= J2 a i[ ^ m K m M t - -^ujHtH e u, J (42) 

1=1 ^ e / 

= c^u] ( H^H m - — pH+H e J u, = ^ a^ut^u* (43) 

i=l ^ e / i=1 

where (|42l) follows from the property that tr(AB) = tr(BA). Also, in (|43l) , we have defined <fr = 

Hj^Hm — ^-H^Hg. Since <fr is a Hermitian matrix and {uj} are unit vectors, we have [15, Theorem 
4.2.2] 

uf$u, < A max ($) Vz (44) 

where A max ($) denotes the maximum eigenvalue of the matrix <3>. Recall that a, G [0, 1] and ^\ oti = 1. 
Then, from (|44l) . we obtain 
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TIT 

J s (0) = ^^uj^ < A max ($). (45) 

i=l 

Note that this upper bound can be achieved if, for instance, oil = 1 and «j = Vz ^ 1, and u x is chosen as 
the eigenvector that corresponds to the maximum eigenvalue of <fr. Heretofore, we have implicitly assumed 
that A max (<fr) > and all the available power is used to transmit the information in the direction of the 
maximum eigenvalue. If A max (<fr) < 0, then all eigenvalues of <fr are less than or equal to zero, and 
hence $ is a negative semidefinite matrix. In this situation, none of the channels of the legitimate receiver 
is stronger than those corresponding ones of the eavesdropper. In such a case, secrecy capacity is zero. 
Therefore, if A max ($) < 0, we have C s (0) = 0. Finally, we conclude from (l45l) and the above discussion 
that the first derivative of the secrecy capacity with respect to snr at snr = is given by 

• , s r , X1 . J A max ($) if A max ($) > 

0,(0) = [A max ($)]+ ={ . (46) 

[ else 

If A max ($) > is distinct, C s (0) is achieved when we choose = PuxuJ where u x is the eigenvector 
that corresponds to A max ($). Therefore, beamforming in the direction in which the eigenvalue of $ is 
maximized is optimal in the sense of achieving the first derivative of the secrecy capacity in the Iow-snr 
regime. More generally, if A max (<I>) > has a multiplicity, any covariance matrix in the following form 
achieves the first derivative: 

i 

K x = Pj2 a i u i u l ( 47 ) 

i=l 

where I is the multiplicity of the maximum eigenvalue, {uj}' =1 are the eigenvectors that span the maximal- 
eigenvalue eigenspace of <fr, and {a,} \ =l are constants, taking values in [0, 1] and having the sum J2i=i a i = 
1. Therefore, transmission in the maximal-eigenvalue eigenspace is necessary to achieve C s (0). 

Next, we consider the second derivative of the secrecy capacity. Again, when A max (<I>) < 0, the secrecy 
capacity is zero and therefore C s (0) = 0. Hence, in the following, we consider the case in which A max (<fr) > 
0. Suppose that the input covariance matrix is chosen as in (|47T ) with a particular set of {ai}. Then, using 
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(|4Q|) . we can obtain 



1.(0) = -n R tr ^^^H^uJh^J J +n R j^tr ^ ^ ^HeUiuJ 

/ N 2 \ 

= -n R J2®iaj ^|u]H^H m Ui| 2 - -^|ujHlH e u;| 2 J 



(48) 
(49) 



where (|49l is obtained by using the fact that tr (AB) = tr (BA) and performing some straightforward 
manipulations. Note again that {u^} are the eigenvectors spanning the maximal-eigenvalue eigenspace of 
<fr. Being necessary to achieve the first derivative, the covariance structure given in (l47l) is also necessary 
to achieve the second derivative. Therefore, the second derivative of the secrecy capacity at snr = is the 
maximum of the expression in (|49l) over all possible values of Hence, 



C s (0) = -n R min VWtyl Iu^H^HtoUj 



ai£[0,l]Vi W 



N 2 

|2 ^Vl-.tTxtXT „ I 



(50) 



Since C s (0) is equal to the expression in (|5Q|) when A max ($) > and is zero otherwise, the final expression 
in © is obtained by multiplying the formula in (|50l ) with the indicator function l{A max ($) > 0}. ■ 



B. Proof of Corollary \T} 

The secrecy rate is expressed as 



(snr) 



n R 



log'lct ( I + ^^KX) - logdet fl + ^HeK.Hl 



(51) 



Defining the normalized input covariance matrix as K x = pK^ we can rewrite the secrecy rate as 



J s (snr) = — 
n R 



log det ( I + n R snr HmKjH^ ) - log det ( I + n ^ m SNR HeK^H], 



(52) 



where we, similarly as before, have snr = ^ . Then, using (|39l , we immediately have 



tr (H^H^) - tr ( -j^H e K x Hl 



N„ 



+ 



tr f H m K :E H| n - ^HeK.Ht 



(53) 
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In order to obtain the second derivative, we can apply (l40l) to the positive part of the secrecy rate to obtain 

W) = -n R (tv ((H m K x t4) 2 ) - tr (H e K x Ht) 2 ^ (54) 

= -n R (tr ( 2 - ^ (H e K x Ht) ^ ) . (55) 

Note that the above expression is the second derivative of the positive part of the secrecy rate, and hence 
applies only when the secrecy rate is positive. If the secrecy rate is zero, the second derivative is also zero, 
and hence we have the indicator function in the final expression in (IT8T ). ■ 
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